CVE-2026-80585— mptcp: fastopen: only mark MPTFO subflows with SYN data
Quick assessment
Affected
Linux Linux
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
以下是该 Linux 内核漏洞描述的中文翻译： 在 Linux 内核中，已解决以下漏洞： MPTCP：FastOpen：仅对携带 SYN 数据的 MPTFO 子流进行标记 被动 TCP 快速打开（Passive TFO）机制会在 SYN 报文未携带数据时，仍然接受带有有效 Cookie 的 SYN 报文。在这种情况下，子套接字的接收队列会被有意保持为空。 函数在检查是否存在已入队的 SYN 数据之前，就设置了 标志。这导致没有携带数据的 TFO SYN 触发内核警告（WARN）；如果该警告并非致命错误，则会遗留过时
Possible ATT&CK Techniques 1 AI
T1201.001Affected Version Matrix 12
| Vendor | Product | Version Range | Status |
|---|---|---|---|
| Linux | Linux | 36b122baf6a8bd46b4a591f12f4ed17b22257408< f75f174edc865738522e514d042cf5627f084859 |
affected |
36b122baf6a8bd46b4a591f12f4ed17b22257408< fca7e444c04689fe4cc6b56f2725f804a4bb1ef9 |
affected | ||
36b122baf6a8bd46b4a591f12f4ed17b22257408< 75e564b2ced1cc3d9a8904c7d2d2bb448fffb8b5 |
affected | ||
36b122baf6a8bd46b4a591f12f4ed17b22257408< 72b4a0c51a4b550d40301d60a366b429b8c8e78d |
affected | ||
36b122baf6a8bd46b4a591f12f4ed17b22257408< e00b63056fb4f261455b3e5df5268a1f8ce47a87 |
affected | ||
6.2 |
affected | ||
< 6.2 |
unaffected | ||
6.6.153≤ 6.6.* |
unaffected | ||
| … +4 more rows | |||
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-80585
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
mptcp: fastopen: only mark MPTFO subflows with SYN data
Source: CVE Program / CVE List V5
Vulnerability Description
In the Linux kernel, the following vulnerability has been resolved:
mptcp: fastopen: only mark MPTFO subflows with SYN data
Passive TCP Fast Open accepts a valid-cookie SYN even when it carries
no data. In that case the child socket's receive queue is intentionally
left empty.
mptcp_fastopen_subflow_synack_set_params() set is_mptfo before checking
for queued SYN data. That made data-less TFO SYNs hit a WARN and, if
the warning was non-fatal, left stale MPTFO state behind. The stale
flag could later trigger a state-confusion bug in
check_fully_established().
Only mark the subflow as MPTFO after confirming that an SKB was queued.
Return quietly when the receive queue is empty.
Note that mptcp_subflow_context's is_mptfo field is now not just about
subflows where the TFO was present, but about MPTFO subflow that
consumed SYN data. Only having a valid cookie but not carrying data is
not really "doing TFO".
Source: CVE Program / CVE List V5
CVSS Information
N/A
Source: CVE Program / CVE List V5
Vulnerability Type
N/A
Source: CVE Program / CVE List V5
Affected Products
II. Public POCs for CVE-2026-80585
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-80585
请登录查看更多情报信息。
Patches & Fixes for CVE-2026-80585 (5)
Same Patch Batch · Linux · 2026-08-26 · 92 CVEs total
| CVE-2026-80557 | libceph: fix OOB read in decode_watchers() via missing bounds check | |
| CVE-2026-80553 | s390/vfio_ccw: Cancel existing workqueues | |
| CVE-2026-80552 | s390/vfio_ccw: Ensure index for read/write regions are within range | |
| CVE-2026-80549 | s390/vfio_ccw: Move cp cleanup out of not operational | |
| CVE-2026-80546 | s390/zcrypt: Improve CCA CPRB length and overflow checks | |
| CVE-2026-80547 | s390/vfio_ccw: Implement a crw lock | |
| CVE-2026-80545 | s390/zcrypt: Improve EP11 CPRB length and overflow checks | |
| CVE-2026-80543 | s390/zcrypt: Pad trailing CCA or EP11 message with zeros | |
| CVE-2026-80548 | s390/vfio_ccw: Selectively expand io_mutex | |
| CVE-2026-80555 | s390/vfio_ccw: Free all memory if cp_init() fails | |
| CVE-2026-80554 | s390/vfio_ccw: Limit the number of channel program segments | |
| CVE-2026-80556 | mmc: atmel-mci: Fix use-after-free in atmci_remove due to race condition | |
| CVE-2026-80559 | Input: sur40 - fix input device registration ordering | |
| CVE-2026-80558 | libceph: Avoid using invalid osd indices from primary_temp | |
| CVE-2026-80560 | openrisc: signal: do not restore privileged SR bits on sigreturn | |
| CVE-2026-80561 | libceph: fix multiple unsafe decodes in decode_locker() | |
| CVE-2026-80562 | gpio: ml-ioh: use raw_spinlock_t for the register lock | |
| CVE-2026-80563 | gpio: sloppy-logic-analyzer: fix use-after-free via debugfs trigger on unbind | |
| CVE-2026-80564 | gve: fix NULL dereference due to missing ptp adjfine | |
| CVE-2026-80565 | crypto: qce - fix error path in devm_qce_register_algs |
Showing top 20 of 92 CVEs. View all on vendor page → →
IV. Related Vulnerabilities
Same product: Linux
-
CVE-2026-80589
block: stop the timeout timer when releasing a never added d -
CVE-2026-80588
mptcp: reclaim forward-allocated memory on RX path errors -
CVE-2026-80587
mptcp: avoid combining some incoming suboptions -
CVE-2026-80586
mptcp: options: reset DSS fields in case of unexpected size -
CVE-2026-80584
s390/qeth: validate user buffer length in SNMP and ARP query
Same vendor: Linux
-
CVE-2026-80589
block: stop the timeout timer when releasing a never added d -
CVE-2026-80588
mptcp: reclaim forward-allocated memory on RX path errors -
CVE-2026-80587
mptcp: avoid combining some incoming suboptions -
CVE-2026-80586
mptcp: options: reset DSS fields in case of unexpected size -
CVE-2026-80584
s390/qeth: validate user buffer length in SNMP and ARP query
V. Comments for CVE-2026-80585
No comments yet